A vulnerability, which was classified as critical, was found in cute_headers cute_png 1.05. This affects the function cp_block in the library cute_png.h. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_block() function at cute_png.h.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-46267 since 09/11/2024. The exploitability is told to be easy. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-273192, VDB-278962, VDB-278963 and VDB-278964 are pretty similar.

Productinfo

Vendor

• cute_headers

Name

• cute_png

Version

• 1.05

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion